CVE-2026-23902: 
Java vulnerability analysis and mitigation

CVE-2026-23902 is an Incorrect Authorization vulnerability in Apache DolphinScheduler that allows authenticated users with system login permissions to use tenants not defined on the platform during workflow execution. It affects all versions of Apache DolphinScheduler prior to 3.4.1 (Maven package org.apache.dolphinscheduler:dolphinscheduler-api). The vulnerability was disclosed on April 24, 2026, with the fix available in version 3.4.1. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, OSS-Security).

The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning the platform fails to correctly validate whether a tenant specified during workflow execution is actually defined and permitted within the system. An authenticated attacker with standard system login credentials can craft workflow execution requests referencing arbitrary or undefined tenant identifiers, bypassing the intended authorization boundary. No user interaction is required, and the attack is conducted over the network with low complexity. The vulnerability was reported by researcher Jihang Yu (OSS-Security, GitHub Advisory).

Successful exploitation allows authenticated attackers to execute workflows under tenant contexts that are not sanctioned by the platform, potentially gaining unauthorized access to tenant-specific resources, data, and configurations. This can result in high confidentiality and integrity impacts — including unauthorized data access and manipulation across multiple tenant environments — though availability is not directly affected. In multi-tenant deployments, this could enable cross-tenant data exposure and privilege escalation within the workflow execution context (GitHub Advisory, OSS-Security).

1. Authentication: Obtain valid credentials for an Apache DolphinScheduler instance running a version prior to 3.4.1 — any account with system login permissions is sufficient.
2. Identify workflow execution endpoint: Locate the workflow execution API endpoint (e.g., within the dolphinscheduler-api module) that accepts a tenant parameter as part of the workflow run configuration.
3. Craft malicious request: Submit a workflow execution request specifying a tenant name or identifier that is not defined or registered within the DolphinScheduler platform, bypassing the expected tenant validation check.
4. Execute workflow under unauthorized tenant: The platform incorrectly authorizes the request, executing the workflow under the specified undefined tenant context, potentially granting access to resources, file paths, or data associated with that tenant scope.
5. Access restricted resources: Leverage the unauthorized tenant context to read, modify, or exfiltrate tenant-specific data or configurations that would otherwise be inaccessible (OSS-Security, GitHub Advisory).

• Logs: DolphinScheduler API logs showing workflow execution requests referencing tenant names not present in the platform's tenant registry; repeated authorization-related log entries from a single authenticated user account.
• Application Behavior: Workflow executions associated with tenant identifiers that do not appear in the platform's configured tenant list; unexpected access to resources or file paths associated with non-existent tenants.
• Network: Unusual or high-frequency POST requests to DolphinScheduler workflow execution API endpoints from authenticated sessions, particularly with non-standard tenant parameter values.

Users should upgrade Apache DolphinScheduler to version 3.4.1 or later, which contains the fix for this vulnerability (GitHub Advisory, OSS-Security). For organizations unable to patch immediately, implementing network-level access controls to restrict who can reach the DolphinScheduler API and monitoring for workflow execution attempts involving undefined tenants are recommended interim measures. Limiting system login permissions to only trusted users can also reduce the attack surface.

The vulnerability was announced via the Apache OSS-Security mailing list and the Apache announcement list on April 24, 2026, by DolphinScheduler maintainer Wenjun Ruan (OSS-Security, Apache Announce). Social media activity was limited, with brief mentions on Bluesky and Mastodon from security-focused accounts. No significant researcher commentary or major media coverage has been identified beyond standard vulnerability aggregator listings.